Daily update · Aug 20–21, 2026

Linux kernel update: EFI hang fixes, NTFS hardening, and networking improvements

Today's mainline kernel patches address EFI runtime service hangs, NTFS memory safety, networking bugs, and more.

Bug fixes Hardware support Performance Security and hardening

#EFI #filesystems #hardware support #networking #performance #security

117 meaningful commitsDaily snapshot

In brief

Today's Linux kernel patches bring a mix of stability, security, and performance improvements. Key fixes include bounding EFI runtime service waits to prevent system hangs, hardening NTFS against memory corruption, resolving several networking issues (AF_XDP, TCP-AO, IPv6 multipath), and improving squashfs and TCP performance. Hardware support is added for Apple MacBook Pro USB tethering.

Bug fixes

Bound EFI runtime service waits to prevent system hangs

When an EFI runtime service call hangs in firmware, the kernel now times out after 120 seconds, disables runtime services, and prevents later calls from entering the wedged firmware. Non-blocking paths also honor the disabled state.

Why it matters: Prevents permanent system hangs and cascading failures on systems with buggy UEFI firmware.

60618389de92 bb50e70f4ffe 4b2c033b5bc9

Fix ARM boot hang caused by get_cycles() regression

A recent delay timer calibration rework broke get_cycles() on ARM, causing boot hangs on configurations like multi_v5_defconfig. The ternary condition is fixed.

Why it matters: Restores reliable booting for affected ARM systems.

e1e3a0ab69c6

Fix AF_XDP NULL pointer dereference in receive path

xsk_buff_alloc() return value is now checked in the multi-buffer receive loop, preventing a crash when the fill queue contains invalid entries.

Why it matters: Prevents kernel crashes for AF_XDP users, such as high-performance packet processing applications.

e37b2abca804

Fix ksmbd stale connections and TCP timer handling

ksmbd now enables TCP keepalive on accepted sockets and keeps TCP timers alive for kernel sockets, preventing stale connections from consuming the connection quota and stuck FIN-WAIT-1 orphans.

Why it matters: Improves reliability of the in-kernel SMB server when clients disappear or become unreachable.

56549c18a4f7 80b6367ec37f

Fix IPv6 route exception dump race

Route exception dumping now uses RCU-safe list iteration to avoid a data race with concurrent PMTU updates.

Why it matters: Prevents incorrect output or potential crashes when dumping IPv6 routes while PMTU updates are happening.

47cdab0d51aa

Fix ACPI deferred device power initialization

ACPI device power state initialization is deferred until after the device is ready for enumeration, preventing power resources from being leaked and kept on.

Why it matters: Fixes unnecessary power consumption on systems with deferred ACPI enumeration, such as some RISC-V boards.

dc948f8b384a

Fix scheduler CPU share calculation for cgroups

tg_cpus() is now floored at 1, preventing a zero shares_max from bypassing the MIN_SHARES clamp and leaving a group entity with zero weight.

Why it matters: Ensures correct CPU bandwidth distribution for cgroups, avoiding potential division issues and unexpected starvation.

23906f3a1686

Fix kernel panic when toggling hardware VLAN offload

Toggling hardware VLAN TX offload on a lower device could change hard_header_len without proper synchronization, leading to skb_under_panic and data races in the transmit path.

Why it matters: Users with VLAN interfaces and hardware VLAN offload could experience kernel panics or corrupted packets when the offload setting is changed.

447cbe95ebb9

Fix divide-by-zero in IPv6 multipath routing

A race between route updates and ignore_routes_with_linkdown changes could make the first pass of rt6_multipath_rebalance return zero total weight, causing a division by zero in the second pass.

Why it matters: IPv6 multipath routing could crash the kernel under concurrent route changes; this makes the code robust.

d2c26c2911dd

Fix uninitialized address ID in MPTCP syncookie path

When rebuilding an MPTCP request socket under SYN cookies, local_id was not restored, leaving uninitialized stack data that could corrupt path-manager subflow bookkeeping.

Why it matters: MPTCP connections using SYN cookies could experience subflow state corruption, potentially causing connection failures or misrouting.

b878dfdd12d7

Fix 32-bit backlog overflow in qdiscs

gred, bfifo, and plug qdiscs computed backlog plus packet length in 32 bits, so after 4 GiB of backlog the sum wrapped and admission kept accepting packets, causing unbounded queue growth.

Why it matters: Routers and traffic-controlled links with very large queues could see memory exhaustion and packet loss; the fix prevents the overflow.

4c660ee8c809

Fix kernel panic on invalid PCS in phylink

phylink_inband_caps() only checked for NULL PCS, but mac_select_pcs can return an error pointer, leading to a NULL dereference when accessing PCS ops.

Why it matters: Ethernet drivers using phylink could panic if a PCS selection fails; this adds proper error checking.

f2849b1fd059

Fix bogus energy readings on Intel RAPL counter wraparound

The RAPL PMU did not sign-extend the energy counter delta on wraparound, causing turbostat and perf to report absurdly large power values.

Why it matters: Users monitoring power on Intel CPUs (e.g., with turbostat) will no longer see occasional impossible wattage readings.

a8b842366f8f

Fix runtime PM stuck blocked after failed suspend prepare

If a device's prepare callback failed, runtime PM remained blocked, causing later pm_runtime_enable() to report an error and leaving the device in a bad state.

Why it matters: Systems with devices that fail suspend preparation could experience runtime PM errors and device power management issues after resume.

cb258d651d74

Fix torn reads of neighbor hardware addresses in bridge and VXLAN proxy

ARP/ND proxy paths in the bridge and VXLAN drivers read neighbor hardware addresses directly, which could be torn while the neighbor is being updated. They now use a stable snapshot.

Why it matters: Virtualization and container networking with bridge/VXLAN proxy features will avoid occasional corrupted MAC addresses and potential packet misdelivery.

57549ab90791 b824059a673b

Fix NFS pNFS cache keying and layout segment leak

The pNFS data server cache was keyed only on multipath address, causing a NULL dereference when the same address served both NFSv3 and NFSv4 flexfiles devices. Additionally, the layout process forget path failed to free layout segments, leaking memory.

Why it matters: Prevents crashes and memory leaks for NFS flexfiles users, improving long-term stability.

13c23c5cb977 ee5a386cfe60

Security and hardening

Fix multiple NTFS memory corruption and DoS issues

Several NTFS driver bugs were fixed: an off-by-one page overflow in decompression, an unvalidated update sequence number offset causing use-after-free, a resource leak exploitable via setxattr, and invalid empty mapping pairs.

Why it matters: Prevents crashes, memory corruption, and denial-of-service when accessing corrupted or malicious NTFS filesystems.

98716c9fce21 81684340963d 9969d58a9b04 766062a82e1c

Rate-limit efivarfs statfs() to prevent SMM flood

statfs() on efivarfs now rate-limits calls to the EFI QueryVariableInfo() runtime service to twice per second.

Why it matters: Prevents unprivileged users from causing severe system slowdowns by flooding SMM-based variable stores on x86.

b2326338dc68

Fix TCP-AO use-after-free on reconnect

The TCP-AO current_key pointer is now properly cleared when keys are freed during reconnect to a different peer.

Why it matters: Prevents potential crashes or memory corruption for users of TCP-AO, e.g., BGP sessions.

da4471557f27

Fix use-after-free in AF_PACKET TX_RING

The packet socket TX_RING code freed a vmalloc ring while skbs still referenced it, and deferred the reference drop until after writing frame status, preventing a use-after-free.

Why it matters: Applications using packet sockets with TX_RING (e.g., traffic generators) could crash or be exploited; this closes a memory-safety hole.

992cc9f94ca9

Randomize inetpeer tree to harden rate limiting

The inetpeer rate-limiting system used a deterministic RB-tree keyed on IP addresses, allowing off-path attackers to predict evictions and manipulate token buckets. The comparison is now randomized with SipHash.

Why it matters: Hardens the kernel's peer rate limiting against off-path attacks, improving resistance to resource-exhaustion and rate-limit bypass.

2ee66e948717

Performance

Reduce squashfs cache wakeup storms

squashfs_cache_put() now wakes only one waiter per freed cache entry instead of all waiters, avoiding a thundering herd.

Why it matters: Improves performance and reduces CPU overhead for concurrent reads from squashfs images, common in containers and embedded systems.

f6f47a9ca82b

Advertise TCP MSS from configured MTU instead of learned PMTU

The MSS advertised in SYN packets is now derived from the interface/route MTU rather than a previously learned path MTU, which could be smaller due to asymmetric routing.

Why it matters: Improves TCP throughput on asymmetric paths and avoids permanently capping connections to a stale PMTU.

2640e6419594

Hardware support

Add support for Apple MacBook Pro USB tethering (product ID 0x1902)

The cdc_ncm driver now recognizes MacBook Pro models that present as USB product ID 0x1902 over USB4/Thunderbolt, using the same private interface layout as 0x1905.

Why it matters: Owners of Apple MacBook Pro (e.g., M1 Max) can use USB tethering to Linux hosts that lack PCIe tunneling support.

746fc0787f61

Source commits117 entries +

ecbccdbdab5d

efi/runtime-wrappers: factor out efi_rts_park_worker()

Breno Leitao · Jun 16, 2026 · 4 files

c554d4e534bb

efi/runtime-wrappers: handle queue_work() failure with goto exit

Breno Leitao · Jun 16, 2026 · 1 files

7f64cb373f3d

efi/runtime-wrappers: check EFI_RUNTIME_SERVICES before using efi_rts_work

Breno Leitao · Jun 16, 2026 · 1 files

60618389de92

efi/runtime-wrappers: bound the wait for EFI runtime service calls

Breno Leitao · Jun 16, 2026 · 1 files

bb50e70f4ffe

efi/runtime-wrappers: honour EFI_RUNTIME_SERVICES in the non-blocking paths

Breno Leitao · Jun 16, 2026 · 1 files

4b2c033b5bc9

efi/runtime-wrappers: retire the worker if a wedged call ever returns

Breno Leitao · Jun 16, 2026 · 1 files

eb01ffabeb52

efi: apple-properties: validate setup data header length

Pengpeng Hou · Jul 6, 2026 · 1 files

34b7e953d19a

irqchip/ast2700-intc: Disable all interrupt merge banks on probe

Michael Pesa · Jul 22, 2026 · 1 files

01787ed2fde4

efi: make efi_guid_to_str() take a const GUID pointer

Vincent Mailhol · Jul 22, 2026 · 1 files

b2326338dc68

efivarfs: Rate limit statfs() handler

Ard Biesheuvel · Aug 1, 2026 · 1 files

8049741ac93a

RDMA/ucma: Allow path records to exactly fit the output buffer

Serhat Kumral · Aug 6, 2026 · 1 files

f6f47a9ca82b

squashfs: avoid thundering-herd cache wakeups

Usama Arif · Aug 7, 2026 · 2 files

d9c0fd5533fb

lib/interval_tree: fix allocation warning messages

Karl Mehltretter · Aug 8, 2026 · 1 files

5146e0688d86

prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator

Bradley Morgan · Aug 9, 2026 · 1 files

dfe88f832fe8

mailmap: update email address for Linfeng Sun

Linfeng Sun · Aug 10, 2026 · 1 files

bec0eed29b41

ocfs2: bound-check dir entries in the readdir re-validation scan

Zhan Xusheng · Aug 11, 2026 · 1 files

763c097f71bc

ocfs2: bound-check dir entries in the inline-data re-validation scan

Zhan Xusheng · Aug 11, 2026 · 1 files

447cbe95ebb9

vlan: fix skb_under_panic and races when toggling HW VLAN offload

Eric Dumazet · Aug 11, 2026 · 1 files

3dfc0ab5fefd

irqchip/gic-v5: Clear per-CPU IRS data on teardown

Sascha Bischoff · Aug 11, 2026 · 1 files

ac6db0e0bee1